CVE-2025-21287: Windows 10 1507 Privilege Escalation Flaw

CVE-2025-21287 Overview

CVE-2025-21287 is an elevation of privilege vulnerability in the Windows Installer service. An authenticated local attacker can abuse the flaw to obtain SYSTEM-level privileges on affected Windows client and server platforms. Microsoft published the advisory as part of the January 2025 security update cycle.

The issue is classified under CWE-269: Improper Privilege Management. The vulnerability requires local access and low privileges, and it does not require user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the affected host.

Critical Impact
A low-privileged local user can escalate to SYSTEM on any unpatched Windows 10, Windows 11, or Windows Server release, providing full control of the operating system.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-01-14 - CVE-2025-21287 published to NVD alongside Microsoft's advisory
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21287

Vulnerability Analysis

CVE-2025-21287 resides in the Windows Installer service (msiexec), which executes package operations under the NT AUTHORITY\SYSTEM security context. Because the service performs privileged file and registry operations on behalf of standard users, any weakness in the way it validates caller-controlled inputs can be turned into a local privilege escalation primitive.

Microsoft categorizes the defect as improper privilege management [CWE-269]. In practice, this class of flaw in Windows Installer typically involves the service acting on paths, symbolic links, or intermediate files that a low-privileged user can influence between the time the installer checks them and the time it uses them. The attacker leverages this window to redirect a privileged operation against a target the user could not normally modify.

Exploitation yields high impact across confidentiality, integrity, and availability. An attacker who reaches SYSTEM can install persistence, disable security tooling, dump credentials from LSASS, and pivot to domain resources from a workstation foothold.

Root Cause

The root cause is improper enforcement of privilege boundaries during installer-initiated operations. The Windows Installer service performs actions with elevated rights while consuming state that a standard user can partially control, allowing the user's context to influence the outcome of a SYSTEM operation.

Attack Vector

The attack vector is local. The adversary must already have code execution as a standard, interactive user on the target Windows host. From that position, the attacker interacts with msiexec and the Windows Installer service to trigger the privileged code path and redirect its effects to a resource they should not be able to modify.

No network access, administrative credentials, or user interaction from a second account is required. As of publication, no public proof-of-concept exploit and no CISA KEV listing are associated with CVE-2025-21287. The EPSS probability is 0.538%.

Refer to the Microsoft CVE-2025-21287 Advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-21287

Indicators of Compromise

Unexpected .msi or .mst files staged in world-writable directories such as C:\Windows\Installer, C:\Windows\Temp, or per-user %TEMP% immediately before privileged Installer activity.
New services, scheduled tasks, or local administrator accounts created by msiexec.exe shortly after execution by a standard user.
Windows Installer rollback files (config.msi, *.rbf, *.rbs) being written to or renamed under directories controlled by non-administrative users.

Detection Strategies

Alert on msiexec.exe spawning interactive command interpreters (cmd.exe, powershell.exe) or LOLBins under the SYSTEM account when initiated by a non-administrative session.
Correlate Windows Event ID 1042 (MsiInstaller) and 4688 (process creation) to identify installer operations that end in privilege changes for the calling user.
Monitor for symbolic link, junction, and hard link creation by low-privileged processes targeting paths later accessed by msiexec.exe.

Monitoring Recommendations

Ingest Sysmon (Event IDs 1, 11, 15) and Windows Security logs into a centralized analytics platform and baseline normal msiexec.exe behavior per host role.
Track privilege escalations from Medium to High or System integrity levels that follow installer activity within a short time window.
Review MSI repair and reconfiguration operations (msiexec /fa, /i, /y) originating from standard user contexts, which are common vectors for Installer abuse.

How to Mitigate CVE-2025-21287

Immediate Actions Required

Apply the January 2025 Microsoft security update that addresses CVE-2025-21287 to all affected Windows client and server systems.
Prioritize patching multi-user systems such as terminal servers, VDI hosts, and jump servers where local users are common.
Audit local group membership and remove unnecessary interactive logon rights for standard users on high-value hosts.

Patch Information

Microsoft has released fixes through the standard Windows Update channels. Consult the Microsoft CVE-2025-21287 Advisory for the specific KB article and build numbers that correspond to each affected Windows version, and validate deployment through your patch management system.

Workarounds

No official workaround is published by Microsoft; patching is the supported remediation path.
As a compensating control, restrict who can log on locally and disable the AlwaysInstallElevated policy in both HKLM and HKCU if enabled.
Enforce application control (WDAC or AppLocker) to block execution of unsigned or user-writable .msi packages by standard users.

bash

# Verify AlwaysInstallElevated is disabled (both keys must be 0 or absent)
reg query "HKLM\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated
reg query "HKCU\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated

# Confirm the January 2025 cumulative update is installed
wmic qfe list brief /format:table | findstr /i "2025"